--- Begin Message ---
On Fri, 21 Jul 2000, Pavel Kankovsky wrote:
> For instance, if Chris' telnetd patch is used, and all telnetd instances
> run under the same uid, a compromised telnetd process can ptrace() (at
> least unless some setcap() magic or something similar is used) other
> instances and manipulate with them (read passwords, insert commands).
No.
The process starts as root and then (before any potentially compromisable
network parsing) does setuid() to another user.
If you switch uids but don't do an exec(), this leaves current->dumpable =
0 in the kernel. Result: the unprivileged telnetd processes cannot
ptrace() each other.
Speaking of ptrace(), though, the chroot()'ed telnetd process definitely
should run under its own uid and not something like nobody. Otherwise a
compromised chroot()'ed nobody process can ptrace() a nobody process[1]
which isn't chroot()ed, and so escape the jail. I'm just guessing, but I
bet the kernel doesn't spot this case => kernel bug.
Cheers
Chris
[1] Although note that I'm trying to ensure most nobody process, and in
fact daemons in general, run with current->dumpable = 0. This can be
accomplished by using binaries with permissions -rwx--x--x
--- End Message ---